Four men considered suspects in the assassination of the half-brother of North Korea’s leader at a Kuala Lumpur airport were caught on security cameras there changing clothes and their appearance before fleeing, an investigator testified Thursday.

Testifying in the murder trial of Indonesian Siti Aisyah, 25, and Vietnamese Doan Thi Huong, 28, police investigator Wan Azirul Nizam Che Wan Aziz said one of the men, known as “Hanamori,” led the killing of Kim Jong Nam at Kuala Lumpur International Airport 2 (KLIA 2) on Feb. 13.

“The investigation revealed that suspect Hanamori played the role as mastermind of the incident,” Wan Azirul testified at the Shah Alam High Court, near Kuala Lumpur.

Wan Azirul, who is attached to Sepang district police headquarters, also testified that one of the men known only as “Mr. Chang” had shaved his beard after the incident at KLIA 2.

The four men who remain at large are believed to be North Koreans. They are named as defendants along with Siti Aisyah and Doan.

“Hanamori” had arrived at the airport in the same vehicle with “Mr. Chang” and a third suspect, “Mr. Y,” 90 minutes before the attack, the investigator told the court.

“Hanamori even had Mr. Chang and Mr. Y meet him later at Bibik Heritage Restaurant,” the investigator said, adding that he also met the fourth suspect, identified as “James,” at the same café before the attack.

Siti Aisyah and Doan have pleaded not guilty, saying they were tricked into attacking Kim Jong Nam as part of a reality TV prank. Defense lawyers claim they were scapegoats and victims of an elaborate trick involving the four men.

The two women face the death penalty if convicted of charges that they murdered Kim, the estranged sibling of North Korean dictator Kim Jong Un, by smearing deadly VX nerve agent on his face.

Previously, the court viewed footage of the women allegedly attacking Kim Jong Nam before heading to separate restrooms and fleeing the airport.

Wan Azirul said Mr. Chang was seen donning a grey hooded shirt, a pair of black shoes with white stripes and a pair of black-framed glasses before meeting Hanamori at the café at 7:49 a.m. Mr. Chang still had a beard and moustache and was holding a white plastic bag.

“This image of a guy, who is wearing a purple shirt, is Hanamori at 7:49 a.m.,” the investigator testified. “What I want to show in this video is that after Mr. Chang met Hanamori in Bibik Heritage and had a brief conversation, Mr Chang took a black Adidas cap and wore it. Before he went to meet Hanamori, he did not wear the cap.”

Suspects met at café

Security videos then showed Mr. Chang meeting with Siti Aisyah at the same cafe and Mr. Y walking together with Doan near the crime scene.

Soon after the two women allegedly accosted Kim Jong Nam and smeared the nerve agent on his face, footage showed that Mr. Chang, Mr. Y and Hanamori had changed their shirts, Wan Azirul said.

He then testified that Mr. Chang went into a restroom at Level 4 of the airport around 9 a.m. and exited 12 minutes later.

“This time it can be seen that Mr. Chang changed to a red shirt, is no longer wearing a black cap and the plastic bag he is holding is also of different color, orange.

“At this juncture, I could recognize him because of his body shape and he was still wearing the same pairs of shoes,” Wan Azirul said. “We can also see that Mr. Chang no longer has moustache and beard. He is already clean shaven.”

The investigator said Mr. Y and Hanamori had changed their clothes and Mr. Y ditched his cap and backpack.

“Three of them, Mr. Y, Mr. Chang and Hanamori were then seen at KLIA (main airport). I also found that they had changed their clothes and were later seen together at the departure hall,” Wan Azirul said, adding they left the budget airport in the same vehicle.

James, who recruited Siti Aisyah according to the investigator, was seen heading to a KLIA hotel where he went into a room.

“He is later seen at the departure hall of KLIA with the three other men,” the investigator said.

Wan Azirul previously identified Mr. Y and Mr. Chang and said they were believed to have smeared liquid on the women’s hands before they allegedly attacked Kim Jong Nam.

Judge Azmi Ariffin adjourned the trial to resume on Nov. 6 as he wanted to review the CCTV videos.